Merge branch 'android-msm-pixel-4.14-sc-security' into android-msm-pixel-4.14-sc-qpr1
Jan 2022.1
Bug: 204278308
Change-Id: I56e715538f8fadc47b5bfbf89ebc249ed61f1bbc
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 92d2de0..5367c2f 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -770,6 +770,12 @@
ext4_write_lock_xattr(inode, &no_expand);
BUG_ON(!ext4_has_inline_data(inode));
+ /*
+ * ei->i_inline_off may have changed since ext4_write_begin()
+ * called ext4_try_to_write_inline_data()
+ */
+ (void) ext4_find_inline_data_nolock(inode);
+
kaddr = kmap_atomic(page);
ext4_write_inline_data(inode, &iloc, kaddr, pos, len);
kunmap_atomic(kaddr);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 9940a59..1a4d89f 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -443,6 +443,8 @@
static int gre_handle_offloads(struct sk_buff *skb, bool csum)
{
+ if (csum && skb_checksum_start(skb) < skb->data)
+ return -EINVAL;
return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
}
